Out-of-Bounds Read Vulnerability in Linux Kernel Affecting USB Gadget Configuration

CVE-2025-38497

What is CVE-2025-38497?

A vulnerability in the Linux kernel's USB gadget configuration allows an out-of-bounds read when writing an empty string to certain sysfs attributes. Specifically, the functions handling 'qw_sign' and 'landingPage' failed to validate input length before accessing memory beyond the buffer. This could lead to undefined behavior or potential information leaks. A patch has been applied to the functions that ensures input is checked for zero-length and handles such cases appropriately, enhancing system integrity.

References